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GROUNDED ISOLATION SYSTEM 



CROSS-REFERENCE TO RELATED APPLICATIONS 
Not applicable. 

STATEMENT REGARDING FEDERALLY 
SPONSORED RESEARCH OR DEVELOPMENT 

5 Not applicable. 

BACKGROUND OF THE INVENTION 

The present invention relates to isolation systems for electrically 
isolating access points on a machine and more particularly relates to an 
- isolation configuration which uses safety relays and switches which 
10 redundantly isolate and ground an electrical system during lock-out 
conditions. 

An exemplary automated manufacturing line may include several 
hundred electrically powered devices arranged in device sets at separate 
manufacturing stations, a separate manufacturing process performed by each 

15 device at each station. For example, the devices may include robots, drills, 
mills, transfer lines, clamps, mixing machines, stuffing machines, drying 
machines and so on, each of which is linked to one or more loads such as 
motors for driving the devices through required movements and processes. 
While the inventive configuration is meant to be used with many 

20 different line arrangements and device groupings, to simplify the present 
explanation the invention will be described in the context of an exemplary 
assembly line 300 for, referring to Fig. 4, manufacturing widgets wherein the 
line includes devices arranged at ten consecutive stations 302, 304, 306, 308, 
310, 312, 314, 316, 318 and 320 and wherein each station includes a plurality 

25 of devices (not separately illustrated) which cooperate to perform a complete 
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process. A conveyor 322 or other mechanism powered by a motor 321 
moves work items (not illustrated) from one station to the next. In many 
cases a conveyor will be 3000 or more feet long and may require more than a 
single motor to facilitate conveyance. In addition, as is standard in the 
5 industry, a single master controller including a master control panel 324 is 
provided to control and monitor the entire manufacturing process. To this 
end, panel 324 includes, among other things, miscellaneous controls 350 and 
a master or main disconnect 334. The master control panel 324 is provided 
to control voltages on supply lines 326 which pass through the controller and 
10 run along the entire packaging line to each of stations 302 through 320 and to 
a variable frequency drive (VFD) 328 which controls motor 321 . To control 
station power, disconnect 334 links lines 326 to station controls 330. 
_ When designing a manufacturing or processing line one of the primary 

:jj considerations is line safety as many of the devices at each line station may 

£ 15 inflict injury to an operator in the station vicinity. Typical injuries including 

n s mechanical injury (e.g., falling, crushing, puncture, etc.). For this reason 

%j many stations, and in some cases all stations, will be enclosed in a housing 

^ assembly to ensure that an operator does not inadvertently enter a potentially 

Q hazardous station environment. Hereinafter an exemplary enclosure will be 

pf! 20 referred to as a station and the station or device grouping therein will 

£0 sometimes be referred to as a hazard to indicate the potential danger 

ga associated therewith. 

Despite painstaking design of the processing line stations and of the 
control method associated therewith, often processing problems can occur 
25 which require operator intervention to alleviate the problems. For example, in 
the case of the exemplary processing line described above, assume that a 
riveting station 302 or hazard is set up to fire rivets into work items as the 
items are transferred therethrough. If a work item becomes jammed between 
station devices the item may cause a backlog of work items at the station 
30 and, possibly cause additional jamming. In this case, to eliminate the jamb, 
an operator would have to enter station 302 and physically remove the jamb. 

To facilitate operator intervention, typically line access points are 
provided. In the present example, it will be assumed that a cage is formed 
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about riveting station 302 and that an opening there into is formed in the 
cage. 

To ensure that an operator entering a station via an access point is not 
injured, standard practice within the industry requires that power to the station 
5 be entirely cut off via a power down mechanism. By cutting off power to the 
station, all station devices cease mechanical movement and the possibility of 
injury is essentially eliminated. 

Referring still to Fig. 4, primitive and still prevalent power down 
mechanisms include a master or main disconnect switch 334 linked to the 

10 master control panel. To cut power, switch 334 is tripped which causes 

power to the entire line to shut down. Because the master control panel 324 
is often remote (e.g., perhaps 3000 feet) from some line stations, it is always 
possible that a second operator may reclose disconnect switch 324 while a 
first operator is within a station thereby causing a potential hazard. To 

15 eliminate this possibility the industry has configured standard lockout 

disconnect switches and has devised standard lockout-tag out procedures. 
To this end, after a disconnect switch is opened, the switch can be locked in 
the open position and tagged (i.e., an actual tag is placed on the lock 
identifying the operator) by the operator who locked the switch to ensure that 

20 the switch remains open. ^ P __ ======= ^^ 




While the master disconnect switcln 324 is advantageous, a system 
including only a master switch 324 is disadvantageous for several reasons. 
First, as indicated above, typically the switch is located at a master control 
panel 324 which may be remote from an access point. In this case, once the 
25 operator recognizes a problem whiofri requires operator intervention, the 

operator has to halt line operation/run to the master control panel 324, open 
the master disconnect switch 33^, lock out and tag the switch 334, perform a 
lockout/tag out power off verification to ensure lockout and tag out, walk back 
to the problem station 312, access the station 312 to eliminate the problem, 
30 walk back to the control panel 324, untag and unlock the disconnect switch 
334, close the switch 334 and then start the process once again. While this 



process may not seem b^raensome where a processing line is relatively short 
(e.g., 10 stations long), this process is extremely burdensome in cases where 



u a line may have many stations whicbi may be up to 3000 or more feet from the 
^ master control panel 324 where problems occur routinely (e.g., several times 
^ per operator shift). / 

this process is also relatively 
5 expensive for two reasons. First, employee time is expensive and any 
process which requires an employee to traverse from one point to another 
without being productive reduces processing line efficiency. Second, during 
the time when the line is powered down, output is stalled. The time required 
to travel to and from the disconnect switch reduces line output. While this 

10 may be relatively unimportant in cases where inexpensive products are being 
processed, down time and the resulting production loss is extremely important 
where expensive products (e.g., vehicles, etc.) are being manufactured. 

Second, the electrical contacts on typical disconnect switches 
effectively wear out over the course of a relatively short life time. For 

15 example, Underwriter's Laboratories mandates 10,000 operations and good 
disconnect switches last for approximately twenty thousand switching cycles 
prior to required replacement. 

Third, disconnect switches are purposefully designed such that an 
extremely large force is required to open or close the switch. Such a design 

20 substantially reduces the possibility of inadvertent switching. Unfortunately, 
the required force also places excessive stresses on the disconnect switch 
mechanical components which often cause mechanical failure (e.g., 
breakage). 

To address the shortcomings of systems which include a single master 
25 disconnect switch, the industry has developed a voltage supervision relay 
(VSR) based system for locally cutting off power to a station thereby 
electrically isolating the station. To this end, referring to Fig. 1 , an exemplary 
system 10 is illustrated in the context of a station or hazard 12 which is linked 
to three voltage supply lines L1 , L2 and L3. For each hazard 12, system 10 
30 includes an isolation relay, a VSR, a system lockout switch (SLS) 18 and a 
safety light 20. 
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SLS 18 includes first and second contacts 22 and 24 which are 
mutually exclusive (i.e., when one contact 22, 24 is closed, the other 22 or 24 
is open and vice versa). 

The VSR includes, among other things, voltage sensing and 
5 comparison hardware and a VSR coil represented by a VSR block 16 and two 
normally open (NO) contacts VSR-1 and VSR-2. The isolation contactor 
includes a coil and positively guided contacts including three NO contacts IC- 
1 , IC-2 and IC-3 and one normally closed (NC) contact IC-4. 

Lines L1 and L2 are used to provide power to VSR block 16, coil 14 
10 and light 20. To this end, line L1 forms a voltage rail 26 while line L2 forms a 
voltage rail 28. Contacts VSR-1 and VSR-2 are in series with SLS contact 22 
and safety light 20 between rails 26 and 28. Similarly, SLS contact 24 is in 
series with coil 14 between rails 26 and 28. 

Block 16 is linked between each of contacts IC-1, IC-2 and IC-3 and 
15 hazard 12 for sensing voltage thereat. Contact IC-4 is linked to block 16 as 
an enabling contact. Block 16 only operates when contact IC-4 is closed. 
After sensing voltages, block 16 compares the sensed voltages to a threshold 
voltage (e.g., 10 volts) to determine if power is being provided to hazard 12. 
Where power is provided to hazard 12, current is not provided to the VSR coil 
20 and therefore contacts VSR-1 and VSR-2 remain open. Where power is not 
provided to hazard 12, current is provided to the VSR coil and therefore 
contacts VSR-1 and VSR-2 both close. 

Referring still to Fig. 1, during normal operation, SLS 18 is in an ON 
position wherein contact 22 is open and contact 24 is closed. In this case 
25 current passes through isolation coil 14 so that contacts IC-1 , IC-2 and IC-3 
are closed and contact IC-4 is open. Because contact 22 is open, light 20 is 
off. 

Next, assuming a process malfunction associated with hazard 12 
causes a problem which must be eliminated by an operator, first the operator 
30 locally turns off the motor drive. Second, the operator locally (i.e., proximate 
hazard 10 and the process malfunction) turns SLS 18 from ON to OFF 
thereby opening contact 24 and closing contact 22. When contact 24 is 
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opened, current to coil 14 is cut off such that contacts IC-1 , IC-2 and IC-3 are 
all opened while contact IC-4 is closed thereby enabling block 16. 

Because each of contacts IC-1, IC-2 and IC-3 are all open, VSR block 
16 should not sense a voltage above the threshold voltage. On one hand, 
5 where the sensed voltages are below the threshold voltage, block 16 

energizes the VSR coil and hence closes contacts VSR-1 and VSR-2 causing 
light 20 to illuminate. Illuminated light 20 indicates that hazard 12 has been 
electrically isolated and that entry through an associated access point should 
be safe. After lockout and tag out procedures, the operator can enter hazard 
10 12 to eliminate the problem. 

On the other hand, where block 16 senses one or more voltages which 
are greater than the threshold voltage, block 16 does not energize the VSR 
coil and hence contacts VSR-1 and VSR-2 remain open despite closed switch 
22. In this case, light 20 is not illuminated and the operator knows it is not 
15 safe to service hazard 12. 

This VSR system works well but has two primary shortcomings. First, 
VSR block 16 is relatively expensive and increases system costs appreciably 
over the simple disconnect switch configuration. 

Second, the VSR is not field repairable, is difficult to understand and is 
20 difficult to trouble shoot. 

Therefore, a need exists to provide a safe and relatively inexpensive 
system for remotely (e.g., locally) electrically isolating machines or 
processing/manufacturing line hazards. Preferably the such a system would 
ensure that no current or voltage is provided to a hazard during lockout 
25 conditions. 

BRIEF SUMMARY OF THE INVENTION 

To overcome the shortcomings described above, the present invention 
includes a method wherein, when electrical isolation for a machine, station or 
manufacturing line has been selected by a system operator, in addition to 
30 disconnecting voltage supply lines from the machine, device, etc., the lines 
are also linked to a grounding node to ensure that no power is provided. In 
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addition, preferably, the method includes monitoring the ground node to 
ensure that the ground node remains grounded. Where the lines have been 
linked to the ground node and the ground node is in fact grounded, an 
indicator, preferably in the form of a light, indicates a safe device, machine, 
5 etc. 

Also, preferably, the isolation selection mechanism and indicator 
corresponding to a specific device, machine, station, etc., is located 
proximate the station for easy and expedited access. 

In addition to the method, the invention also includes an apparatus 
10 which is used to perform the method. 

Thus, one object of the invention is to provide a machine isolation 
mechanism which ensures electrical isolation when electrical isolation is 
ct selected. 

=S Another object of the invention is to achieve the aforementioned object 

;£ 15 in a relatively inexpensive manner. To this end, the preferred relay and 

H switching configuration described herein is considered advantageous. 

\j One other object is to ensure that a grounding node is actually 

^ grounded thereby further ensuring that no power is provided to a station after 

O electrical isolation has been selected. 

SI 20 Yet another object of the invention is to provide a system which 

S3 enables local selection of electrical isolation. To this end, a separate isolation 

.pi 

:Jj selector and indicator can be provided at each of several different stations 

along a manufacturing line thereby facilitating local isolation. 

One other object is to enable single failure detection of a failed contact 
25 and require system maintenance when a single failure occurs. The inventive 
system includes positively guided contactors and relays as well as safety 
relays which, upon a single open or closed contact failure, electrically isolate 
the station or stations associated with the failed contact and which will not 
allow the system which supplies power to the isolated stations(s) to the reset 
30 without maintenance to repair the failed contact. 

These and other objects, advantages and aspects of the invention will 
become apparent from the following description. In the description, reference 
is made to the accompanying drawings which form a part hereof, and in which 
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there is shown a preferred embodiment of the invention. Such embodiment 
does not necessarily represent the full scope of the invention and reference is 
made therefor, to the claims herein for interpreting the scope of the invention. 

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 



5 Fig. 1 is a schematic view of a prior art isolation system; and 

Fig. 2 is a schematic diagram illustrating the inventive isolation system; 
Fig. 3 is a flow chart illustrating a preferred method according to the 
present invention; 

Fig. 4 is a schematic diagram of an exemplary manufacturing line 
10 including hardware consistent with prior art disconnect configurations; and 
Fig. 5 is a schematic diagram similar to Fig. 4, albeit illustrating a 
manufacturing line including an inventive disconnect configuration. 

DETAILED DESCRIPTION OF THE INVENTION 

15 Referring now to the drawings and, specifically, referring to Fig. 5, the 

invention will be described in the context of an exemplary manufacturing line 
400 which is similar to line 300 illustrated in Fig. 4, albeit including additional 
inventive grounding and remote isolation hardware. Line 400 includes ten 
stations 402, 404, 406, 408, 410, 412, 414, 416, 418 and 420 spaced along 

20 the length of a conveyor 422 for performing various sub-processes on work 
items moved therealong. A motor which drives conveyor 422 is powered by a 
variable frequency drive 438 or other controls. Power and controls for 
stations 402 through 420 are collectively identified by numeral 430. 

A main or master control panel 424 receives power on three supply 

25 lines collectively identified by numeral 326 and provides power to line 

components which require power. Panel 424 includes miscellaneous panel 
control 450, a main or master disconnect switch 434 and a ground isolation 
system (GIS) 452. Main disconnect 434 links supply lines 426 to GIS 452, 
power provided to GIS 452 via lines L1 , L2 and L3. GIS 452 links lines L1 , L2 

30 and L3 to each of VFD 438 and controls 430. Collectively VFD 438, controls 
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430 and hardware controlled thereby is referred to as hazard 52. Thus, 
hazard 52 includes a manufacturing line which has a plurality of stations, 
each station having a plurality of different devices which cooperate to perform 
some tasks on a work item. For example, the devices may include motors, 
5 drills, mills, gluing, cooking, riveting, welding, drying, stirring, painting, 
cleaning, members, etc. 

Referring still to Fig. 5, each station 402 through 420 includes a station 
distinct remote lock-out switch (RLS) RLS-1, RLS-2, RLS-3, RLS-4, RLS-5, 
RLS-6, RLS-7, RLS-8, RLS-9 and RLS-1 0, respectively. GIS 452 and RLSs 1 
10 through 10 will collectively be referred to as an electrical isolation system 50. 
Referring now to Figs. 2 and 5, as described above, hazard 52 is 
linked via exemplary and inventive isolation system 50 to the three voltage 
supply lines L1 , L2, and L3. When an operator elects to link lines L1 , L2 and 
3 L3 to intermediate nodes 60, 62 and 64 voltage is provided to hazard 52. 

; £ 1 5 Hereafter it will be assumed that a motor at one particular station 402 is for 

SI moving a rivet gun into a position to rivet two pieces of sheet metal together. 

yi System Hardware 

□ Electrical isolation system 50 includes a plurality of components which 

In cooperate to enable a user to either provide power to hazard 52 or, in the 

□0 20 alternative, to cut off power to hazard 52 and ground intermediate nodes 60, 

2 62 and 64 ( see Fig. 2). When nodes 60, 62 and 64 are grounded, an 

operator may access any of the stations associated with hazard 52 via access 
locations after a lockout-tagout operation has been performed to ensure that 
power is not again provided to the specific station. To verify that power at a 
25 specific station has been cut off, indicators, preferably in the form of lights 
(e.g., see 90 in Fig. 2) , are provided proximate each access location. When 
an access location light is lit, it is safe to enter the corresponding station. 
Similarly, when an access location light is not lit, the inventive system has 
identified an unsafe condition and the operator should not enter the station. 
30 To facilitate the aforementioned functions, system 50 includes a 

plurality of relays, switches, fuses and indicator lights. A relay is a device 
which includes at least one coil and an associated contact. A contact is 
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essentially a two stage switch having a normal state (i.e., open or closed) and 
an excited state (i.e., the opposite of the normal state). A contact having a 
normally closed state is referred to as an NC contact while a contact having a 
normally open state is referred to as an NO contact. When current passes 
5 through the coil, the relay changes contact states. Thus, when the coil is 
energized, the NC contacts open and NO contacts close. In many cases, a 
relay will include more than a single contact. For example, a relay may 
include three NO contacts and one NC contact or five NO contacts and one 
NC contact. In a relay having three NO contacts and one NC contact, when 

10 the coil is energized, all three NO contacts close and the NC contact opens. 
With a relay, when a NO contact is welded closed, corresponding NC 
contacts cannot close and vice versa. This type of a relay is referred to as a 
positively guided relay. 

As well known in the art, relays can be combined in specific 

15 configurations to perform specific tasks. One special type of relay 

configuration is generally referred to as a safety relay configuration. A safety 
relay configuration typically includes, among other things, one or more relays, 
one or more NC emergency stop (ES) switches, a start switch and a logic 
power source. Typical configurations include both a control circuit or a safety 

20 relay circuit and at least one output. The safety relay circuit is designed to 
effectively "determine" whether or not an operator wants power to be 
delivered to a device (e.g., a motor, another coil, etc.) based on a recent 
sequence of start and stop commands selected via start and ES switches. 
The output is designed to either provide power to, or cut power off 

25 from, the device based on operation of the safety relay circuit. To this end, 
an output typically includes two or more relay contacts (hereinafter "output 
contacts") in series between a driving voltage source and the device, each of 
the output contacts having to be closed to provide power to the device. 

The safety relay circuit is designed such that, when the start switch is 

30 closed, the relay coils are energized causing the output contacts to close 

(thereby providing power to the device). The ES switches are arranged such 
that when the ES switches are opened, coil current is cut off and all properly 
operating contacts associated therewith change state (i.e., closed contacts 
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open and open contacts close). Thus, when the ES switches are open the 
output contacts open and power to the motor is cut off. After power is cut off, 
assuming properly operating contacts, power can again be provided by 
closing the start switch. 
5 Referring still to Fig. 2, among other things, system 50 includes a 

safety relay circuit which includes a start button or switch 78, and an ES 
switch 80 and first and second relay configurations 76A and 76B, 
respectively. Switches 78 and 80 are linked to second configuration 76B. 
When the proper sequence of switches 78 and 80 is performed, output 
10 contacts associated with configuration 76B are all closed. 

With respect to a first safety relay configuration 76A, although not 
illustrated, the first configuration includes circuitry which monitors the integrity 
^ of cables which link remote lock-out switches to the safety relay control 

5 circuitry. To this end, the first safety relay configuration includes two relays 

;t; 1 5 which are arranged in a manner similar to the configuration described above. 

N In Fig. 2, output contacts corresponding to first safety relay configuration 76A 

^ are collectively specified by box 72. Output contacts corresponding to the 

! J1 first relay in the first configuration are identified by references IK1-m where m 

□ indicates a relay specific contact (i.e. m=1 , 2 or 3) while contacts 

1=1 20 corresponding to the second relay in the first configuration 76A are each 

j 5 identified by references 1K2-m where m again specifies a relay specific 

S contact. Thus, each of the relays in the first safety relay configuration 76A 

include six NO contacts in box 72. 

With respect to second safety relay configuration 76B, although not 
25 illustrated, the second configuration includes circuitry which monitors switches 
78 and 80 to determine when power should be provided to and cut off from 
hazard 52. Essentially second configuration 76B facilitates starting and 
emergency stop functions. To this end the second safety relay configuration 
76B also includes two relays arranged in a manner similar to the configuration 
30 described above. In Fig. 2, the output contacts corresponding to second 
safety relay configuration 76B are collectively specified by box 74. Output 
contacts 2K1 and 2K2 in box 74 correspond to the first and second relays in 
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the second relay configuration 76B, respectively (i.e. each of the second 
configuration relays only include a single NO output contact). 

Referring still to Fig. 2, generally, the components of system 50 form a 
control configuration, a controller for controlling the control configuration and 
5 a grounding configuration. In addition to the contacts in safety relay boxes 72 
and 74, the control configuration includes first and second isolation contactors 
and a control relay. A contactor is similar to a relay in that it has some 
combination of related NO and NC contacts and a coil. The difference 
between a relay and a contactor is that the contactor is designed to handle 

10 power while the relay is designed to handle logic level signals. The first 

isolation contactor includes four NO contacts IK1-1 , IK1-2, IK1-3, and IK1-4, 
one NC contact IK1-5, and a first isolation coil 1-1. Similarly, the second 
isolation relay includes three NO contacts IK2-1, IK2-2 and IK2-3, one NC 
contact IK2-4, and a second isolation coil I-2. The control relay includes one 

15 NO contact CR-1 , two NC contacts CR-2 and CR-3 and a control relay coil 
CR. 

The grounding configuration includes a ground contactor and a ground 
control relay. The ground contactor includes four NO contacts G-1 , G-2, G-3 
and G-4, one NC contact G-5, and a ground coil G. The ground control relay 

20 includes a single NO contact GC-1 , and a ground control coil GC. 

In addition to safety relay circuits 76 and switches 78 and 80, the 
controller includes remote lockout switches and system isolation indicators. 
Referring to Fig. 5, because line 300 includes ten stations, ten RLSs and 
corresponding indicators are provided. Nevertheless, referring to Fig. 2, to 

25 simplify this explanation only three RLSs, RLS1 , RLS2 and RLS3, are 

illustrated along with corresponding indicators 90, 92 and 94. Indicators 90, 
92 and 94 are preferably lights. In addition to the components described 
above, system 50 also includes a current limiting power supply 65, fuses 95, 
96 and 97 and a transformer 66. 

30 Referring still to Fig. 2, the above-described components are linked 

together as follows. A first isolation contactor contact IK1-1 is linked in series 
with a second isolation contactor contact IK2-1 and fuse 95 between voltage 
line L1 and node 60. Similarly, fuse 96 and contacts IK1-2 and IK2-2 are 



-12- 



linked in series between line L2 and node 62 while fuse 97 and contacts IK1- 
3 and IK2-3 are linked in series between line L3 and node 64. Hereinafter, 
contacts IK1-1, IK1-2, IK1-3, IK2-1, IK2-2 and IK2-3 will be referred to 
generally and collectively as "line contacts." 
5 Ground contacts G-1 , G-2 and G-3 are linked between intermediate 

nodes 60, 62 and 64, respectively, and a grounding node 100. Grounding 
node 100 is linked via an equipment grounding conductor (EGC) to ground. 
Ground control coil GC is linked between ground node 100 and line L3. 
Transformer 66 includes a primary winding linked between lines L1 

10 and L2 and a secondary winding which is linked between a ground rail 68 and 
a voltage rail 70. 

First isolation coil 1-1 is linked in series with a plurality of contacts 
between rails 68 and 70. Specifically, coil 1-1 is linked in series with NO 
control relay contact CR-1, first safety relay configuration contacts 1K1-1 and 

15 1K2-1, second safety relay configuration contacts 2K1 and 2K2, and NC 
ground contact G-5. One intermediate node 102 exists between boxes 72 
and 74, and another intermediate node 104 is provided between first 
intermediate coil 1-1 and contact G-5. Coil I-2 is linked in series with contact 
IK1-4 and contacts 1K1-2 and 1K2-2 corresponding to the first safety relay 

20 configuration 76A between intermediate nodes 102 and 104. Thus, coil I-2, 
like coil 1-1, is in series with a plurality of contacts between rails 68 and 70. 

First safety relay configuration output contacts 1K1-3 and 1K2-3 form a 
parallel contact pair and the pair is in series with control relay coil CR 
between rails 68 and 70. Ground coil G is in series with contacts IK2-4, IK1-5 

25 and CR-2 between rails 68 and 70. 

Current limiting power supply 65 is linked to rails 68 and 70 and 
provides current limited rails to the controller components including a ground 
rail 110 and a voltage rail 112. An intermediate rail between rails 110 and 
112 is identified by numeral 114. 

30 Each of the remote lockout switches RLS1 , RLS2 and RLS3 are 

similarly configured and operate in a similar manner and therefore only switch 
RLS1 will be explained here in detail. Switch RLS1 includes a pair of 
contacts 1 1 7 and 1 1 8 and another contact 1 1 6, pair 1 1 7 and 1 1 8 mutually 

-13- 



exclusive with respect to contact 116 (i.e., when contact 1 16 is closed contact 
pair 1 1 7 and 1 1 8 is open and vice versa). Each contact 116, 117 and 118 
forms an open circuit and includes a closing member 120, 121, 122, 
respectively, for closing the corresponding open circuit. As illustrated, 
5 member 120 closes its corresponding circuit while members 121 and 122 
open their corresponding circuits. Switch RLS1 is capable of two mutually 
exclusive states, including an ON state and an OFF state. Switch RLS1 is 
illustrated in the OFF state wherein member 120 closes contact 116 and 
members 121 and 1 22 form open circuits at contacts 1 1 7 and 118. In the 

10 alternative, when switch RLS1 is ON, member 120 forms an open circuit at 
contact 116 while members 121 and 122 close contacts 117 and 118. 

Switch RLS2 includes a contact pair 131 and 132 and another contact 
130 while switch RLS3 includes contact pair 135 and 136 and another contact 
134. Contacts 118, 132 and 136 are linked in series between first safety 

15 relay configuration 76A terminals which must be shorted in order for 
configuration 76A to close corresponding contacts in box 72. Similarly, 
contacts 117, 131 and 135 are linked in series between a second pair of first 
safety relay configuration terminals which also must be shorted in order for 
configuration 76A to close corresponding contacts in box 72. Thus, when 

20 each of contacts 1 17, 1 18, 131 , 132, 135 and 136 are closed, if all of the first 
safety relay configuration contacts operate properly, each of the first safety 
relay configuration contacts (i.e., the contacts in box 72) close. 

Each of RLSs RLS1 , RLS2 and RLS3 is a lock-out/tag-out switch 
which, upon being opened can be locked out and tagged out in a 

25 conventional manner. 

First contact 1 16 is linked in series with indicator 90 between rails 110 
and 114. Similarly, contact 130 is linked in series with indicator 92 between 
rails 110 and 114 while contact 134 is linked in series with indicator 94 
between rails 110 and 114. Contacts CR-3, GC-1 and G-4 are linked in 

30 series between rail 112 and intermediate rail 114. 

Referring still to Fig. 2, preferably ground coil G is mechanically linked 
to isolation coils 1-1 and I-2 such that ground coil G cannot alter the states of 
corresponding contacts (i.e., G-1 , G-2, etc.) while either of coils 1-1 or I-2 or 
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both 1-1 and I-2 are altering states of their corresponding contacts. In other 
words contactor G and contactors 1-1 and I-2 are mutually exclusive. 



Operation 




Referring still to Fig. 2, in operation /with each of switches RLS1, RLS2 
and RLS3 in their ON positions such thatyfcontacts 1 1 7, 1 1 8, 1 31 , 1 32, 1 35 
and 136 are closed and first contacts 1 16, 130 and 134 are open, when 
switches 78 and 80 are manipulated by an operator in an effort to provide 
power to hazard 52, all of the safety relay output contacts (i.e. contacts in 
boxes 72 and 74) are closed. In this' case, control relay coil CR is energized 
10 such that control relay contact CR-/ is closed and contacts CR-2 and CR-3 
are both open. Thus, all of the contacts in series with coils 1-1 and I-2 are 
closed and each of coils 1-1 and If2 are energized. As current flows through 
coils 1-1 and I-2, all of the line contacts (i.e., IK1-1, IK1-2, IK1-3, IK2-1, IK2-2 
and IK2-3) close and power is provided to hazard 52 (i.e., referring also to 
15 Fig. 5, power is provided to VRD 428 and controls 430 to drive motor 421 and 
each of stations 402 throughy420). In addition, isolation contacts IK2-4 and 
IK1-5 are both op en when cp ils 1-1 and I-2 are energized. 



Moreover, because each of the contacts IK2-4, IK1-5 and CR-2 is 
open, ground coil G is not energized and therefore ground contacts G-1 , G-2, 
20 G-3 and G-4 remain open while contact G-5 remains closed. If the EGC is 
actually grounded, voltage is applied across ground control coil GC and 
therefore contact GC-1 is closed. 

Furthermore, because each of contacts CR-3 and G-4 is open and 
each of contacts 116, 1 30 and 1 34 is open, none of indicator lights 90, 92 
25 and 94 are lit. 

Next, it will be assumed that the process at the exemplary riveting 
station (i.e., 402 in Fig. 5) malfunctions during system operation. It will also 
be assumed that switch RLS1 and indicator light 90 are associated with 
station 402. To this end, switch RLS1 and light 90 are located proximate 
30 riveting station 402. 

When the process malfunctions, an operator turns off the drive which 
controls the process. Prior to entering the station, the operator must first 
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verify electrical isolation of that station (i.e., no power is being provided to any 
of the devices which together constitute the station). To verify electrical 
isolation of the station, the operator switches switch RLS1 from the ON 
position to the OFF position as illustrated in Fig. 2. When switch RLS1 is 
5 turned OFF, member 120 closes contact 116 while members 121 and 122 
open contacts 117 and 118. When members 121 and 122 open contacts 117 
and 118, first safety relay configuration 76A causes each of the output 
contacts in box 72 to open. When contacts 1K1-1, 1K1-2, 1K1-3, 1K2-1, 1K2- 
2 and 1 K2-3 open, voltage is cut off from each of coils 1-1 , I-2 and CR. 
10 When voltage is cut off from coils 1-1 and I-2, ideally each of the line 

contacts IK1-1, IK1-2, IK1-3, IK2-1, IK2-2 and IK2-3 is opened thereby cutting 
off power to nodes 60, 62 and 64. In addition, when voltage is cut off from 
coils 1-1, I-2 and CR, contacts IK2-4, IK1-5 and CR-2 all close (i.e., each of 
iS those contacts is a NC contact) and ground coil G is energized. When 

;S 15 ground coil G is energized, contacts G-1, G-2, G-3 and G-4 all close and 

sj contact G-5 opens. When contact G-5 opens, an additional open circuit is 

=J provided in series with coils 11 and 12 to ensure power is cut off from nodes 

■Jl 60, 62 and 64. When contacts G-1 , G-2 and G-3 are closed, each of 

o intermediate nodes 60, 62 and 64 is linked to ground node 100. Thus, if 

If- 20 ground node 100 is actually linked to ground, no power can be applied to 

00 nodes 60, 62 and 64. 

Referring still to Fig. 2, when node 100 is actually grounded, voltage is 
still applied across ground control coil GC and therefore contact GC-1 
remains closed. However, if node 100 should, for any reason (e.g., contact 
25 with an inadvertent power cable) be ungrounded, current is cut off from coil 
GC and contact GC-1 opens. Thus, after RLS1 is turned OFF, if all of the 
relays are working properly to ground nodes 60, 62 and 64 and if node 100 is 
actually grounded, each of contacts CR-3, GC-1 and G4 are closed. In 
addition, because member 120 is closed across contact 116, voltage is 
30 provided between rails 110 and 112 which illuminates indicator 90. 

Therefore, indicator 90 lights up indicating that it is safe for the operator to 
enter the station to service the malfunctioning process. Similar operation 
occurs when either of switches RLS2 or RLS3 are turned OFF. Prior to 
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entering station 402 through an access point, switch RLS1 is locked out and 
tagged out to ensure safety. Illumination of light 90 verifies a locked out 
condition. 

Industry accidents sometimes occur which could result in an 
5 inadvertent short circuit of the control wiring to the switches RLS1 , RLS2 and 
RLS3 of safety relay circuit 76A. For example, crushing the wires could result 
in a short across contacts 118, 132 and 136. Nevertheless, series contacts 
117, 131 and 135 provide a redundancy such that, even if contacts 118, 132 
and 136 are shorted, configuration 76A will still operate to isolate hazard 52 
10 and prevent the system isolation light from coming on when any one of 

switches 116, 130 or 134 is turned OFF and the resetting of the contactors is 
prevented. 

It should be appreciated that while the configuration of Fig. 2 is a 
preferred embodiment which is advantageous because of its simple, relatively 

15 inexpensive and exceedingly robust design, the invention contemplates a 
relatively broad method which is independent of the hardware configuration 
used to facilitate the method. To this end, referring to Fig. 3, an exemplary 
method according to the present invention is illustrated. Although not 
illustrated, it is contemplated that a processor could perform the inventive 

20 method and, and in this regard, one embodiment of an exemplary processor 
is system 50 ( see Fig. 2). 

Referring still to Fig. 3, at decision block 200 the processor determines 
if an operator has selected a station for electrical isolation. If the station has 
not been selected for isolation, the processor enters a monitoring loop until 

25 selection is identified. Where electrical isolation has been selected, at 

process block 202 the processor links the motion bus nodes 60, 62 and 64 
( see Fig. 2 again) to ground node 100. 

At decision block 204 the processor determines if ground node 100 is 
actually grounded (i.e., in Fig. 2 this is accomplished by coil GC and contact 

30 GC-1). If node 100 is not grounded, at block 206 the processor indicates an 
unsafe condition (e.g., will not light up a "system isolated" light). If node 100 
is grounded, at block 208, the processor indicates a safe station (e.g., will 
light up a "system isolated" light). 
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It should be understood that the methods and apparatuses described 
above are only exemplary and do not limit the scope of the invention, and that 
various modifications could be made by those skilled in the art that would fall 
under the scope of the invention. For example, while the preferred method 
5 includes some mechanism for determining if a grounding node is actually 
grounded, the invention contemplates systems and methods which do not 
include this feature. 

In addition, the preferred system 50 ( see Fig. 2) may be configured in 
many other ways. For instance, the safety relay output contacts may be 
10 differently configured to include fewer or more redundancies. 

To apprise the public of the scope of this invention, the following claims 
are made: 
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